Log in Start free

Vulnerability · Published Jul 23, 2026 · Assigned by VulDB

CVE-2026-16653boazsegev facil.io Public Folder http.c http_sendfile2 path traversal

Medium 5.3

In plain English

A medium-severity path traversal in facil.io from boazsegev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.7%top 47.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

VendorProductVersions
boazsegev facil.io 0.7.00.7.10.7.20.7.30.7.40.7.50.7.60.7.7

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References